DMA Hardware Readers Explained: PCIe Cheats and Why They Beat Kernel Anti-Cheat

A DMA cheat is not a program running on the gamer's PC. It is a second computer, wired through a PCIe card, reading the target machine's RAM directly over the bus while the game is running. The target OS never issues the read, never sees the descriptor, and never gets a callback to complain about it. That is the entire threat model, and it is why kernel anti-cheat cannot detect a well-configured rig no matter how many callbacks it registers.

Two computers, one cable

A conventional software cheat has to live somewhere on the box running the game. Even a kernel-mode manual mapper (covered in our writeup on how kernel cheats bypass usermode AC) is still code executing inside the target's ring 0, subject to ObRegisterCallbacks, PsSetCreateProcessNotifyRoutineEx, and every hypervisor introspection trick Vanguard or EAC wants to throw at it. A DMA setup deletes that assumption.

The rig has three parts:

1. Gaming PC (the "target"). Clean Windows install, standard anti-cheat, no injected code, no unsigned drivers.
2. Second PC (the "reader" or "second box"). Hosts the cheat logic, ESP overlay renderer, aim solver, and network layer.
3. A PCIe DMA card slotted into the target's motherboard, cabled to the reader over USB 3.0 or a dedicated fiber link.

The target sees the PCIe card as an unbranded (or, if the firmware is competent, a spoofed) device. The reader sees the target's physical RAM as a file it can seek into. That separation also sidesteps the fingerprinting logic covered in our HWID spoofers explainer: the target's identity looks fine because nothing malicious is running on it.

How PCIe DMA works when nobody's checking

PCIe is a peer bus. Every device on it (GPU, NVMe, network card, sound chip) can issue memory read and memory write transactions against system RAM without asking the CPU. That is the whole point of DMA, and the reason your NVMe drive is not bottlenecked by the host doing memcpy loops. The chipset's root complex translates PCIe TLPs (Transaction Layer Packets) into memory-controller reads.

A DMA cheat card is a PCIe device whose firmware answers "yes" when the reader PC says "give me 4 KiB at physical address 0x3A800000." The read hits the memory controller, returns the bytes, and travels back over the PCIe link and out the USB cable to the reader. The target CPU is not interrupted. No syscall fires. No page fault happens. The OS's virtual memory manager, page-table ACLs, and kernel callback stack are all irrelevant because none of them sit on the code path.

Ulf Frisk's PCILeech project, public on GitHub since 2016 and demonstrated at CanSecWest, is the canonical open implementation. His MemProcFS layer even reconstructs the target's virtual address space from raw physical reads by walking the paging structures manually, so the reader can address r5apex.exe+0x14BC000 instead of chasing physical frames.

# Reader-side, PCILeech-style probe
pcileech.exe identify

# Dump a range of physical memory to file
pcileech.exe dump -min 0x100000 -max 0x40000000 -out target.raw

# With MemProcFS, mount the target's processes as a filesystem
MemProcFS.exe -device fpga -mount M:
# Now M:\name\r5apex.exe\modules\... is browsable live

The card that answers those commands is usually one of three families.

The hardware: FT601, Screamer, Squirrel

The reference design is a Xilinx Artix-7 FPGA speaking PCIe on one side and USB 3.0 on the other, with an FTDI FT601 bridging the USB link. LambdaConcept's PCIe Screamer M.2 was the first widely available consumer board, and the Squirrel is a smaller descendant. Chinese clones running the same open firmware (the so-called "35T" boards, named for the XC7A35T FPGA) dropped entry pricing to roughly 200 to 300 USD.

Firmware is where the actual battle is fought. Two categories:

• Vanilla firmware. The card enumerates as a generic PCIe device with an obvious FTDI VID/PID over USB. Trivially fingerprinted.
• Spoofed firmware. The card presents copied configuration space (vendor ID, device ID, subsystem ID, BAR sizes) from a known-good peripheral: a specific Realtek NIC, a soundcard, a capture card. The device tree looks normal to Windows.

Rough cost curve:

Add a second PC (a used SFF Optiplex is enough) and, for pixel-perfect video, a capture card feeding the reader from the target HDMI output. Practical all-in entry sits around 500 to 800 USD. Not consumer-mass-market, but not a specialist barrier either. If you are weighing that build against a subscription product, our 2026 cheat-buying guide walks through the tradeoffs in more detail.

What the reader software actually does

Once physical memory is readable, the cheat pipeline is the same set of problems as any external cheat: find the process, resolve pointers, read entity lists, decide, act.

Pattern-scan the raw physical dump for the game's PE header, walk the target process's PML4 to translate virtual addresses, and start pulling structs.

// Sketch of the reader loop
let dev  = pcileech::Device::open("fpga")?;
let dtb  = memprocfs::find_dtb(&dev, "r5apex.exe")?;
let base = memprocfs::module_base(&dev, dtb, "r5apex.exe")?;

loop {
    let local_player = dev.read_u64(dtb, base + LOCAL_PLAYER_OFFSET)?;
    let entity_list  = dev.read_u64(dtb, base + ENTITY_LIST_OFFSET)?;

    for i in 0..MAX_ENTITIES {
        let ent = dev.read_u64(dtb, entity_list + i * 8)?;
        if ent == 0 { continue; }
        let team = dev.read_u32(dtb, ent + TEAM_OFFSET)?;
        let pos  = dev.read_vec3(dtb, ent + POS_OFFSET)?;
        // feed overlay + aim solver
    }
    std::thread::sleep(Duration::from_micros(500));
}

Aim actuation is where DMA rigs get creative. Since the target must not observe cursor movement coming from injected software, high-end setups drive a physical USB device from the reader (an Arduino Leonardo pretending to be a mouse, or a KMBox emulating a wireless dongle) that injects mouse deltas into the target as if a human were moving a physical mouse. The ESP is either painted on a second monitor fed from a capture card, or rendered on the reader's own display next to a game window streamed from the target.

Why anti-cheat is looking in the wrong place

Kernel anti-cheat can hook every syscall it wants. It can walk PsActiveProcessHead, register with PsSetCreateProcessNotifyRoutineEx, hash every driver in \Driver, and pattern-scan the kernel image on a timer. None of those observations run on the DMA card, so none of them fire. The reader PC is not in the target's process tree, its threads do not exist on the target scheduler, and no page-table entry ever gets flipped by cheat code.

The only artifact anti-cheat can look at is the PCIe device itself. That means enumerating the config space, checking for suspicious BAR configurations, correlating device IDs against a known-bad list, and asking "does this device claim to be X while behaving like Y?" Vanguard is the most public example of an AC that ships an ACPI/PCIe enumeration path, and it has produced anecdotal bans against unspoofed 35T boards on League of Legends and Valorant. The problem for the anti-cheat vendor is that this becomes an arms race they cannot win purely from the target side. If firmware perfectly copies a real Realtek E3100 descriptor and never issues traffic on the wrong endpoints while under observation, there is no software-visible tell on the target.

Mitigations that actually work

The correct mitigation lives one layer down, in the platform.

IOMMU (VT-d, AMD-Vi)

The IOMMU is a hardware unit in the chipset that filters DMA. When enabled and configured properly, a PCIe device can only touch memory that the OS has explicitly mapped into its device domain. Attempting a physical read at an unmapped address returns zeros or triggers a fault. Intel calls it VT-d, AMD calls it AMD-Vi. Both have been standard on desktop platforms for over a decade.

The catch: enabling the IOMMU in the BIOS does not automatically make the OS use it for DMA remapping. Windows historically only remapped hot-pluggable Thunderbolt, since that is where most consumer BadUSB-style attacks live. Every internal PCIe slot sat in a passthrough domain, which means devices there had full physical memory access.

Kernel DMA Protection

Microsoft introduced Kernel DMA Protection in Windows 10 1803 (April 2018). It extends IOMMU remapping to hot-pluggable PCIe devices and, on OEM firmware that ships the right ACPI DMAR/IVRS tables, to internal slots as well. On Windows 11 22H2 and later, especially on newer OEM prebuilts, coverage improved considerably.

Check status:

# Is Kernel DMA Protection on?
(Get-CimInstance -Namespace root/cimv2/mdm/dmmap `
    -ClassName MDM_Policy_Result01_DeviceGuard02).DmaGuardEnabled

# Detailed DMA remapping state per device
Get-PnpDevice | Where-Object {
    $_.Class -eq 'System' -and $_.FriendlyName -like '*DMA*'
}

# System info summary
msinfo32.exe   # look for "Kernel DMA Protection: On"

If the answer is "Off," the platform is trusting every PCIe device to behave. On many enthusiast ATX boards, especially older ones without cooperating DMAR firmware, that is the default state after a fresh Windows install.

TPM attestation of the device tree

The endgame is remote attestation. The TPM measures the boot chain, including the ACPI tables (DMAR on Intel, IVRS on AMD) that describe which devices exist and which IOMMU domains they belong to. An anti-cheat service can request an attestation quote and refuse to run if the platform is not in a policy-approved state: Kernel DMA Protection on, no unexpected PCIe device classes present, Secure Boot on, HVCI enforcing. Riot moved League of Legends to require TPM 2.0 for Vanguard on Windows 11 in the Patch 14.9 rollout of May 2024 (Windows 10 systems are exempt from that specific gate, and unlike Valorant, LoL does not enforce Secure Boot). Full DMAR-content attestation is not yet mandatory in any shipping consumer AC, but the mechanism is there and the direction of travel is obvious.

Vanguard On-Demand and the 2026 DMA counter-push

Riot escalated further in 2026. In May 2026, Vanguard began enabling IOMMU on accounts flagged for DMA cheat hardware, specifically to prevent PCIe-based memory readers from touching game memory. Riot publicly denied claims that the update was bricking cheaters' machines. Then on June 24, 2026, Riot shipped Vanguard On-Demand, which lets the driver stay dormant at Windows boot and load only when a Riot game starts, on Windows 11 25H2 machines that meet a stack of prerequisites: UEFI Secure Boot, TPM 2.0, IOMMU, Virtualization-Based Security, and HVCI. The trick is a co-developed "Runtime Driver Attestation" pass that verifies at game launch that no cheat drivers ran while Vanguard was inactive. Riot says roughly 35 percent of the Valorant playerbase currently qualifies, growing 1 to 2 points per month.

Detection vectors that survive

Even if the platform refuses to remap DMA, an AC vendor has a handful of durable signals against DMA rigs:

• Input pattern analysis. Human mouse deltas have jitter, overshoot, and micro-corrections. Solver-driven deltas from a KMBox lack them, or produce statistically clean sinusoidal correction curves. VACnet-class server-side classifiers work directly on this input trace.
• Perfect information usage. A player who consistently pre-fires around corners that require sub-frame reactions is emitting signal regardless of what runs on their PC.
• Overlay artifacts. If the reader draws the ESP on the same monitor through a capture card and HDMI mixer, small delay or resolution mismatches show up in stream recordings.
• Peripheral fingerprinting. Some ACs (Vanguard, BattlEye) enumerate connected USB HID devices and flag known KMBox VID/PID pairs.

Server-side behavioral detection is the direction the industry is moving, because it works regardless of client-side integrity. Client-side platform hardening (IOMMU, DMA protection, TPM attestation) raises the price of hardware cheating; server-side classifiers eventually catch the ones that get past the platform, which is how many DMA users end up on the receiving end of the aggregated sweeps described in our anatomy of a ban wave.

Why KyTech does not sell DMA hardware

Selling a $500 PCIe board is a very different business from writing kernel-mode software, and it comes with different obligations: physical inventory, customs classifications, RMA logistics for FPGA boards, and the reality that a spoofed firmware image must be maintained per game and per anti-cheat build. Vanguard, EAC, and BattlEye all iterate their PCIe enumeration signatures. The support surface is enormous compared to a software product where an update is a signed binary push.

There is also a technical honesty issue. A DMA rig cannot be spoofed away by KyTech and cannot be "supported" without touching hardware the customer owns. KyTech ships software that runs on the customer's own machine, and we can guarantee behavior end to end. That guarantee does not extend to whether a customer's FPGA board correctly copies a Killer E3100 descriptor on the current Vanguard build.

How KyTech handles this

KyTech, founded in 2025 by two engineers, ships kernel-mode cheats for Apex Legends, CS2, Overwatch 2, Black Ops 7, Forza Horizon 6, and Roblox. Everything runs as software on the customer's target PC, protected by our own driver and paired (for Apex Legends, in current beta) with a KyTech HWID spoofer. Details, current game support, and pricing are on the purchase page.

The engineering trade-off is explicit. A KyTech software product operates inside the same threat model that EAC, Vanguard, and BattlEye are actively hunting. That is a harder job than being a DMA rig on the outside of the box, and it requires ongoing driver work every time an AC vendor ships a new callback, hypervisor probe, or attestation policy. The upside for the customer is a single install with no second PC, no soldered hardware, no Arduino mouse chain, no capture card, and a support relationship where a KyTech update fixes a broken loader within hours rather than a firmware reflash performed by the customer.

Where the DMA world beats software is threat-model purity, and we will not pretend otherwise. A properly built DMA rig on a platform with IOMMU disabled is currently invisible to client-side anti-cheat. Where software beats DMA is friction and iteration speed. A KyTech customer buys a subscription, runs an installer, plays; a DMA customer buys a card, buys a second PC, wires it, flashes firmware, updates the firmware every patch, and tracks which capture-card and KMBox combinations are currently unfingerprinted. Both approaches remain viable in 2026, though the platform trajectory (Vanguard On-Demand, universal Kernel DMA Protection defaults on new OEM firmware, TPM attestation creeping toward mandatory) tilts the ground under DMA every quarter. Our bet is that the software side, with a serious kernel driver and a disciplined update cadence, is the right product for players who want to focus on the game rather than the rig. Our flagship KyTech Apex build is where that software-side architecture lives in production against the exact same anti-cheat stack a DMA rig is trying to sidestep.